Implement ACTIVITY-WP-0021 production automation reliability

Root-cause IssueSink 503 (dead Forgejo PAT on issue-core), add state-hub
task sink path B, log runs before emit, harden sync_schedules, deterministic
SBOM/triage reports, DB probe thrash fix, and prod automation-status helper.

src/activity_core/issue_sink.py

@@ -79,7 +79,18 @@ class IssueCoreRestSink(IssueSink):
             headers=self._auth_headers(),
             timeout=10.0,
         )
-        resp.raise_for_status()
+        status = getattr(resp, "status_code", None)
+        if status is not None and status >= 400:
+            # Surface issue-core backend detail (e.g. dead Gitea token → 503)
+            # so Temporal history and operator status are actionable.
+            detail = (getattr(resp, "text", None) or "")[:500]
+            raise RuntimeError(
+                f"IssueCoreRestSink POST {self._base_url}/issues/ "
+                f"failed HTTP {status}: {detail}"
+            )
+        if status is None:
+            # Test doubles may only implement raise_for_status/json.
+            resp.raise_for_status()
         data = resp.json()
         return TaskRef(
             external_id=data["issue_id"],
@@ -97,9 +108,85 @@ class NullSink(IssueSink):
         return TaskRef(external_id=synthetic_id, backend="null")
 
 
+class StateHubProgressSink(IssueSink):
+    """Record each TaskSpec as a State Hub progress event (no Forgejo issues).
+
+    ACTIVITY-WP-0021 path B: when issue-core→Forgejo is unavailable or policy
+    forbids automated Forgejo issues, operators can set ISSUE_SINK_TYPE=state-hub
+    so scheduled definitions still complete with observable evidence.
+
+    Posts event_type=activity_task_spawn (override with STATE_HUB_TASK_EVENT_TYPE).
+    """
+
+    def __init__(
+        self,
+        base_url: str | None = None,
+        *,
+        event_type: str | None = None,
+        author: str = "activity-core",
+        timeout_seconds: float = 10.0,
+    ) -> None:
+        self._base_url = (
+            base_url
+            or os.environ.get("STATE_HUB_URL")
+            or "http://127.0.0.1:8000"
+        ).rstrip("/")
+        self._event_type = event_type or os.environ.get(
+            "STATE_HUB_TASK_EVENT_TYPE", "activity_task_spawn"
+        )
+        self._author = author
+        self._timeout = timeout_seconds
+
+    def emit(self, task_spec: TaskSpec) -> TaskRef:
+        from activity_core.state_hub_write import parse_state_hub_write_response
+
+        external_id = f"sh-{uuid.uuid4()}"
+        body = {
+            "event_type": self._event_type,
+            "author": self._author,
+            "summary": task_spec.title[:240] or "activity-core task spawn",
+            "detail": {
+                "task_ref": external_id,
+                "title": task_spec.title,
+                "description": task_spec.description,
+                "target_repo": task_spec.target_repo,
+                "priority": task_spec.priority,
+                "labels": task_spec.labels,
+                "source_type": task_spec.source_type,
+                "source_id": task_spec.source_id,
+                "triggering_event_id": (
+                    str(task_spec.triggering_event_id)
+                    if task_spec.triggering_event_id is not None
+                    else None
+                ),
+                "activity_definition_id": task_spec.activity_definition_id,
+                "backend": "state-hub-progress",
+            },
+        }
+        resp = httpx.post(
+            f"{self._base_url}/progress/",
+            json=body,
+            timeout=self._timeout,
+        )
+        if resp.status_code >= 400:
+            raise RuntimeError(
+                f"StateHubProgressSink POST {self._base_url}/progress/ "
+                f"failed HTTP {resp.status_code}: {resp.text[:500]}"
+            )
+        data = parse_state_hub_write_response(resp)
+        progress_id = data.get("id") or data.get("outbox_id") or external_id
+        return TaskRef(
+            external_id=str(progress_id),
+            backend_url=f"{self._base_url}/progress/",
+            backend="state-hub-progress",
+        )
+
+
 def get_issue_sink() -> IssueSink:
     """Factory: returns the configured IssueSink based on ISSUE_SINK_TYPE."""
     sink_type = ISSUE_SINK_TYPE.lower()
     if sink_type == "null":
         return NullSink()
+    if sink_type in {"state-hub", "state_hub", "progress"}:
+        return StateHubProgressSink()
     return IssueCoreRestSink()